4 Hyperconvergence Hardening Rules to Live By
There are many security hardening rules that every HCI owner should be living by to achieve the goals of security, confidentiality, integrity, and availability. Even if you think your security posture is seamless, there’s still room to make it even better. Take the time to read through these HCI hardening rules to live by and assess your current infrastructure against them.
Rule 1: Minimize Insider Threats
Insider threats are one of the hardest things to protect against. When you hire an employee to run your HCI environment, in most cases, you give them root level access to the hardware. Root level access to the hardware essentially gives them root level access to all aspects of the HCI architecture. The networking, storage, and compute technologies are all exposed.
There are situations in which an employee becomes disgruntled and proceeds to leave their mark on the company by doing damage to the infrastructure with their elevated privileges. While the disgruntled employee situation is dangerous, it’s probably not as big a threat as the worker with root access who’s not properly trained and/or careless with their actions while logged in with elevated privileges.
The best way to protect your HCI environment from insider threats is education. Management carries much of the burden with this security implementation. Educating the user with mandatory training is the first step. If the training is not completed by the prescribed due date, the user’s elevated privileges should be revoked. Management can do a lot to help protect the HCI environment just through user education and privileged account management.
Rule 2: Protect Each Plane Individually
HCI infrastructure inherently makes applying a singular security solution very challenging. Securing the data center in a traditional infrastructure was much easier before HCI existed. In the past, a big firewall and some load balancers did most of the heavy lifting and would make any organization feel secure.
HCI’s infrastructure design, however, converges the control plane and data plane into one unit. When an administrator is given elevated rights to that infrastructure, they have access to networking, compute, virtualization, and storage in one login. Since the data plane and control plane are now one, traditional security measures aren’t enough for true protection.
The rise of network microsegmentation is one security measure that has allowed for an increased HCI security posture. Another method of securing each plane is to host your database and management nodes on different compute resources.
Not separating them is dangerous: In the event you lose a compute resource, if most of your management resources are on that resource, the management plane is lost. Utilize virtualization vendor security products and apply them in accordance with best practices to protect your virtual hosts and their hosted virtual machines (VMs).
Rule 3: Don’t Put All Your Eggs—or Backups—in One Basket
One of the easiest ways to protect your HCI data is to back it up properly. There’s no situation where a VM snapshot is an appropriate method for a backup. VM snapshots take the .vmdk file and turn it into a “-flat.vmdk” file, which becomes read-only. Then a “-delta.vmdk” file is created, which tracks all the changes made since the backup.
Snapshots are not bad things—they can be helpful in the event an upgrade goes wrong, or when a new application is installed and causes instability. But they are limited, and you need to understand how. If you lose your storage, for instance, you lose access to both the -flat.vmdk and -delta.vmdk, killing your ability to revert to a snapshot.
Further, snapshots tend to pile up over time and waste precious disk space. Don’t use snapshots as a viable backup method—a best practice is to keep a snapshot for no more than 72 hours.
Much like a stock portfolio, diversifying your backups can be beneficial. Having multiple copies of a backup is the best-case scenario to secure your data. A good rule to apply to backups is the “3-2-1 Rule,” which means creating and keeping at least 3 copies of your data, on two different types of backup media, with one backup kept offsite.
Ensuring that your backups are replicated to both primary and secondary storage will provide data redundancy. Additionally, utilizing a cloud storage platform for a tertiary backup option goes even further to ensure CIA is met across your HCI design.
Rule 4: Use a Multi-layered Approach
There is not one singular “best” security method for HCI. The most effective option is to utilize a multi-layered approach to securing your HCI. Continue to utilize the firewall at the network’s edge, but add microsegmentation to your virtual networking to segregate workloads.
Additionally, protect against insider threats by educating not only your administrative staff but also your user base. And, as mentioned previously, limit the use of the root account. When possible, allow only two or three super users access to root credentials.
HCI is a big investment in CapEx and OpEx—protect that investment and ensure the security holy grail of CIA is met with a multi-layered approach.